MAX’s Return Delayed by FAA Reevaluation of 737 Safety Procedures
Re MCAS overriding the crew - it was, in fact, the opposite. The Main Electric Trim (MET) overrode MCAS ever time it was used. As we saw when the Captain was the PF, aggressive MET inputs could counter MCAS inputs. That said, it is apparent from the report that while the Captain was actually making these inputs, he was not articulating what was happening with the trim, likely because of cognitive overload. When he transferred control to the FO, it was without any warning that the stab trim was acting in a peculiar manner. The FO was not nearly as aggressive in making MET inputs. This is not surprising since those types of inputs were outside his normal experience. The FO got increasingly behind the MCAS inputs and ultimately lost control.
Re the AOA DISAGREE annunciator. The AOA DISAGREE function was not operational on the accident aircraft, but its presence would likely have made no difference except for adding yet another warning light to the mix. By design, this annunciation, if working, would not have come on until 400' AFE. During the accident flight, the FO announced the IAS DISAGREE warning within one second of liftoff and the ALT DISAGREE warning within 30 seconds. At the time the ALT DISAGREE annunciation appeared, the Captain's altimeter read 340 feet and the FO's altimeter read 560 feet (Jakarta is very near sea level). Thus an AOA DISAGREE message would have been approximately concurrent with the ALT DISAGREE annunciation.
There is an AOA DISAGREE non-normal procedure, but it is not a memory item. That non-normal checklist, if consulted, would simply directs the crew to the IAS DISAGREE and ALT DISAGREE non-normals. The IAS DISAGREE non-normal directs the crew to the Airspeed Unreliable non-normal. Thus, if the AOA DISAGREE warning was operative, it would not have added any useful information from a procedural standpoint as ultimately the checklists direct the crew to the Airspeed Unreliable procedure. The Captain called for this procedure less than one minute after the IAS DISAGREE call by the FO. If the AOA DISAGREE had illuminated, and the crew had consulted the associated non-normal before doing anything else, it would have potentially delayed their response to the Airspeed Unreliable event.
Re the AOA DISAGREE annunciator. The AOA DISAGREE function was not operational on the accident aircraft, but its presence would likely have made no difference except for adding yet another warning light to the mix. By design, this annunciation, if working, would not have come on until 400' AFE. During the accident flight, the FO announced the IAS DISAGREE warning within one second of liftoff and the ALT DISAGREE warning within 30 seconds. At the time the ALT DISAGREE annunciation appeared, the Captain's altimeter read 340 feet and the FO's altimeter read 560 feet (Jakarta is very near sea level). Thus an AOA DISAGREE message would have been approximately concurrent with the ALT DISAGREE annunciation.
There is an AOA DISAGREE non-normal procedure, but it is not a memory item. That non-normal checklist, if consulted, would simply directs the crew to the IAS DISAGREE and ALT DISAGREE non-normals. The IAS DISAGREE non-normal directs the crew to the Airspeed Unreliable non-normal. Thus, if the AOA DISAGREE warning was operative, it would not have added any useful information from a procedural standpoint as ultimately the checklists direct the crew to the Airspeed Unreliable procedure. The Captain called for this procedure less than one minute after the IAS DISAGREE call by the FO. If the AOA DISAGREE had illuminated, and the crew had consulted the associated non-normal before doing anything else, it would have potentially delayed their response to the Airspeed Unreliable event.
Many thanks for taking the time to explain , Best R
The KNKT Report on LNI 610 appears to have captured the general issues effectively, and given the amount of politics that exists in the background that is a good outcome. It is curious that the prior flight's (LNI 043) involvement of dead heading crew has not been indicated beyond a reference on page 210, para 53 of the Conclusions. That would have reinforced the workload concerns that are raised in the report so is curious.
The report pertinently raises that assumptions of crew response to a failure can be at variance to the real world. The body fo evidence from accident and serious incidents would support that hypothesis. Observing crew performance in a simulator one of the striking observations is the extent of variability that occurs. Watching crews dealing with real malfunctions in the real world appear to show an even greater variation occurs in the real world than in simulation. Lockheed a long time back altered their abnormal and emergency response to a read and do for all (or as many as the regulator would permit), which seemed rational. Reliance on explicit timely responses by humans is at odds with historical human performance, whether being police making split second irreversible decisions, nuclear engineers, doctors or pilots. recent headlines would suggest that would include attorneys and former mayors as well. These assumptions impinge on the analysis as made in CP13471, Revision AH. LNI's input to the draft report also appear to be reasonable.
The report pertinently raises that assumptions of crew response to a failure can be at variance to the real world. The body fo evidence from accident and serious incidents would support that hypothesis. Observing crew performance in a simulator one of the striking observations is the extent of variability that occurs. Watching crews dealing with real malfunctions in the real world appear to show an even greater variation occurs in the real world than in simulation. Lockheed a long time back altered their abnormal and emergency response to a read and do for all (or as many as the regulator would permit), which seemed rational. Reliance on explicit timely responses by humans is at odds with historical human performance, whether being police making split second irreversible decisions, nuclear engineers, doctors or pilots. recent headlines would suggest that would include attorneys and former mayors as well. These assumptions impinge on the analysis as made in CP13471, Revision AH. LNI's input to the draft report also appear to be reasonable.
Re the AOA DISAGREE annunciator. The AOA DISAGREE function was not operational on the accident aircraft, but its presence would likely have made no difference except for adding yet another warning light to the mix. By design, this annunciation, if working, would not have come on until 400' AFE. During the accident flight, the FO announced the IAS DISAGREE warning within one second of liftoff and the ALT DISAGREE warning within 30 seconds. At the time the ALT DISAGREE annunciation appeared, the Captain's altimeter read 340 feet and the FO's altimeter read 560 feet (Jakarta is very near sea level). Thus an AOA DISAGREE message would have been approximately concurrent with the ALT DISAGREE annunciation.
There is an AOA DISAGREE non-normal procedure, but it is not a memory item. That non-normal checklist, if consulted, would simply directs the crew to the IAS DISAGREE and ALT DISAGREE non-normals. The IAS DISAGREE non-normal directs the crew to the Airspeed Unreliable non-normal. Thus, if the AOA DISAGREE warning was operative, it would not have added any useful information from a procedural standpoint as ultimately the checklists direct the crew to the Airspeed Unreliable procedure. The Captain called for this procedure less than one minute after the IAS DISAGREE call by the FO. If the AOA DISAGREE had illuminated, and the crew had consulted the associated non-normal before doing anything else, it would have potentially delayed their response to the Airspeed Unreliable event.
There is an AOA DISAGREE non-normal procedure, but it is not a memory item. That non-normal checklist, if consulted, would simply directs the crew to the IAS DISAGREE and ALT DISAGREE non-normals. The IAS DISAGREE non-normal directs the crew to the Airspeed Unreliable non-normal. Thus, if the AOA DISAGREE warning was operative, it would not have added any useful information from a procedural standpoint as ultimately the checklists direct the crew to the Airspeed Unreliable procedure. The Captain called for this procedure less than one minute after the IAS DISAGREE call by the FO. If the AOA DISAGREE had illuminated, and the crew had consulted the associated non-normal before doing anything else, it would have potentially delayed their response to the Airspeed Unreliable event.
It's addressed in Findings
63. The inhibited AOA DISAGREE message contributed to the inability of the engineer to rectify the problems that occurred on the LNI043 flight which were caused by AOA sensor bias.
5. The AOA DISAGREE alert was not correctly enabled during Boeing 737-8 (MAX) development. As a result, it did not appear during flight with the mis-calibrated AOA sensor, could not be documented by the flight crew and was therefore not available to help maintenance identify the mis-calibrated AOA sensor.
Join Date: Apr 2019
Location: EDSP
Posts: 334
Likes: 0
Received 0 Likes
on
0 Posts
The point that that KNKT were making regarding the absence of the AOA DISAGREE warning was not so much aimed at the accident flight, rather it was aimed at the penultimate flight, LNI043, in particular the likely post-flight maintenance actions.
It's addressed in Findings
and Contributing Factors
It's addressed in Findings
and Contributing Factors
Join Date: Jun 2019
Location: VA
Posts: 210
Likes: 0
Received 0 Likes
on
0 Posts
AoA disagree messages might be useful in some scenarios, but when presented with a sole stick shaker on take-off it would be pretty obvious five seconds later that if you were still climbing normally that the alpha vane was providing bad information. (And hence in disagreement with both the wing and the other vane). A useful thing AoA disagree could have done was disable the MCAS, but of course it wasn’t so designed.
Sensor faults inappropriately triggering built-in protections have caused Airbus accidents too, and they have since developed procedures for stall warning on take-off (for example). Boeing does not provide a similar memory procedure, relying instead on the unreliable airspeed procedure. If a safety feature like pitch feel augmentation, or alpha floor, or overspeed is going to be a part of the plane then they deserve very robust sensor reliability and redundancy. Otherwise the protective features give you one last lesson in irony while they kill you.
Sensor faults inappropriately triggering built-in protections have caused Airbus accidents too, and they have since developed procedures for stall warning on take-off (for example). Boeing does not provide a similar memory procedure, relying instead on the unreliable airspeed procedure. If a safety feature like pitch feel augmentation, or alpha floor, or overspeed is going to be a part of the plane then they deserve very robust sensor reliability and redundancy. Otherwise the protective features give you one last lesson in irony while they kill you.
Join Date: Jan 2013
Location: Seattle Area
Posts: 263
Likes: 0
Received 0 Likes
on
0 Posts
I have no idea how fault discrimination usually happens in the maintenance systems of airborne heavy iron, but logging several consecutive faults like IAS-Disagree, Altitude Disagree and AOA Disagree in case of one single defective sensor does not seem to be very clever at least from the perspective of someone who works on such systems of non-airborne heavy iron.
This means all NNCs tend to require more careful confirmation and use of checklist condition statement than the 80s vintage EICAS or ECAM.
AoA disagree messages might be useful in some scenarios, but when presented with a sole stick shaker on take-off it would be pretty obvious five seconds later that if you were still climbing normally that the alpha vane was providing bad information. (And hence in disagreement with both the wing and the other vane). A useful thing AoA disagree could have done was disable the MCAS, but of course it wasn’t so designed.
Sensor faults inappropriately triggering built-in protections have caused Airbus accidents too, and they have since developed procedures for stall warning on take-off (for example). Boeing does not provide a similar memory procedure, relying instead on the unreliable airspeed procedure. If a safety feature like pitch feel augmentation, or alpha floor, or overspeed is going to be a part of the plane then they deserve very robust sensor reliability and redundancy. Otherwise the protective features give you one last lesson in irony while they kill you.
Sensor faults inappropriately triggering built-in protections have caused Airbus accidents too, and they have since developed procedures for stall warning on take-off (for example). Boeing does not provide a similar memory procedure, relying instead on the unreliable airspeed procedure. If a safety feature like pitch feel augmentation, or alpha floor, or overspeed is going to be a part of the plane then they deserve very robust sensor reliability and redundancy. Otherwise the protective features give you one last lesson in irony while they kill you.
Join Date: Mar 2019
Location: On the Ground
Posts: 155
Likes: 0
Received 0 Likes
on
0 Posts
Especially this part:
If a safety feature like pitch feel augmentation, or alpha floor, or overspeed is going to be a part of the plane then they deserve very robust sensor reliability and redundancy. Otherwise the protective features give you one last lesson in irony while they kill you.
Join Date: Dec 2018
Posts: 48
Likes: 0
Received 0 Likes
on
0 Posts
I will again make the observation that, with the exception of a single MCAS cycle (after which the crew extended the flaps) the ONLY malfunction that this crew was dealing with for the first five minutes was a malfunctioning AOA sensor. That's it. Almost all of the confusing elements that presented themselves during that time could happen TODAY on any 737NG currently flying. These things can happen again on every MAX once they are flying again. Every. Single. One. None of the proposed remedies changes this reality.
No, the crew shouldn't be buried in the checklist. They should perform the memory items and fly the aircraft to a safe altitude where they can stabilize the aircraft, prioritize their actions, and then run the appropriate checklists. That did not happen.
Forget MCAS for the moment. This crew was not well-prepared to handle the AOA malfunction and subsequent warnings, annunciations and divergent instrument readings. They were not prepared because they were never properly trained to handle this malfunction even though it was, in theory, a high priority memory item procedure. There has been a massive training failure, and it has occurred at airlines across the board. Yet, has anything really changed in this regard since these accidents? Among the 737NG pilot community that participates here, I would ask if any of you have seen any significant changes in your company's training regime that would better prepare you for an AOA malfunction on takeoff? I've seen nothing at my airline.
Unfortunately the discussion around MCAS and Boeing's liability tends to suck most of the oxygen out of the room when examining these tragic events. There are other lessons here, and I'm greatly concerned that those lessons are going to be lost because so many people are looking at the bright shining object that is known as MCAS.
No, the crew shouldn't be buried in the checklist. They should perform the memory items and fly the aircraft to a safe altitude where they can stabilize the aircraft, prioritize their actions, and then run the appropriate checklists. That did not happen.
Forget MCAS for the moment. This crew was not well-prepared to handle the AOA malfunction and subsequent warnings, annunciations and divergent instrument readings. They were not prepared because they were never properly trained to handle this malfunction even though it was, in theory, a high priority memory item procedure. There has been a massive training failure, and it has occurred at airlines across the board. Yet, has anything really changed in this regard since these accidents? Among the 737NG pilot community that participates here, I would ask if any of you have seen any significant changes in your company's training regime that would better prepare you for an AOA malfunction on takeoff? I've seen nothing at my airline.
Unfortunately the discussion around MCAS and Boeing's liability tends to suck most of the oxygen out of the room when examining these tragic events. There are other lessons here, and I'm greatly concerned that those lessons are going to be lost because so many people are looking at the bright shining object that is known as MCAS.
And NG doesn't have this failure mode, these fatalities or this accident rate.
That adding runaway trim to all the other conditions, concurrently, put the crew over the edge.
And that MCAS caused that and needs to be fixed.
Which curiously enough is exactly what's happening.
Last edited by pilot9250; 29th Oct 2019 at 01:32.
Join Date: Sep 2019
Location: leftcoast
Posts: 2
Likes: 0
Received 0 Likes
on
0 Posts
FAA asked WHY is MAX still flying -WSJ
From WSJ - but behind paywall- Images cropped from text
‘Why Is This Airplane Still Flying?’ The FAA Missteps That Kept Boeing’s MAX Aloft
Although an agency analysis showed a good chance the Lion Air malfunction would recur, the FAA followed Boeing’s lead on key aspects of the response
By Andy Pasztor and Andrew Tangel
Oct. 28, 2019 8:16 pm ET
Just after a Boeing Co. 737 MAX jet crashed in Indonesia a year ago, FAA officials asked themselves: Should they warn the world the entire fleet could have a design flaw?
A Federal Aviation Administration analysis showed a good chance the same malfunction would crop up again, according to agency officials and people briefed on the results. Even under the most optimistic scenario, the agency’s statistical models projected a high likelihood of a similar emergency within roughly a year.
Yet in the end, the FAA didn’t formally consider grounding the MAX or taking other drastic steps, based on the sketchy early information from the October 2018 accident. It simply reminded pilots how to respond to such emergencies.
That decision set the stage for a second fatal MAX crash, of Ethiopian Airlines Flight 302, less than five months later.
In a critical misstep, FAA officials relied extensively on Boeing’s initial flight-simulator test results, some of the people said. Boeing largely used its cadre of highly experienced test pilots, an industry practice the FAA and accident investigators later acknowledged wasn’t appropriate to gauge how the other pilots would react in a real emergency.
On Monday, an FAA spokesman said the reminder to pilots “followed a rigorous and well-defined process,” adding that the agency’s overall response met regulatory requirements, was approved by multiple agency officials and reflected widely accepted industrywide standards.
Earl Lawrence, head of the FAA’s aircraft-certification office, which approves and monitors new airplane models, was fresh in his post and lacked details about the MAX’s original approval to delve deeply into the situation, said people briefed on the deliberations. He and his team followed Boeing’s lead on diagnosing and resolving the crisis, including Boeing’s predictions that a fix could be developed in time to avert another tragedy.
From front-line FAA engineers and midlevel managers to high-ranking officials at agency headquarters, the consensus was that it wasn’t necessary to take drastic action such as grounding the fleet. FAA officials vouched for the safety of the MAX, even though it included the MCAS feature that eventually was implicated in both crashes.
How the FAA decided against a more-aggressive response to the crash hasn’t been reported before in detail.
That stance has prompted a barrage of criticism on Capitol Hill and elsewhere. The FAA’s decisions are expected to feature in Senate and House committee hearings this week. Lawmakers are expected to ask Boeing Chief Executive Dennis Muilenburg about the company’s interactions with the FAA, including whether it urged the regulator to avoid taking more-forceful action between the crashes.
As the MAX edges toward service again, probably early next year, European safety authorities have formally shelved the idea of ungrounding the MAX simultaneously with the FAA. They want to perform their own simulator tests and analyze additional safeguards.
Other foreign regulators, too, are poised to conduct separate evaluations—something once unthinkable among overseas regulators, who typically followed the FAA in vetting the safety of U.S.-certified planes.
Boeing agreed with the FAA that it was appropriate to reiterate existing pilot procedures before rolling out software changes, a company spokesman said. “The safety of everyone flying on our airplanes was paramount as the analysis was done and the mitigating actions were taken,” he said, adding: “Boeing began work on a potential software update shortly after the Lion Air accident, when MCAS was identified as a potential factor. Boeing agreed to the FAA’s timeline for implementing the software update.”
The FAA spokesman said “There was no regulatory requirement in this instance to use average pilots,” adding that current testing procedures require them. He said Mr. Lawrence “is well-versed in certification standards” even though he wasn’t involved early on with the MAX, and “all meetings and conversations in the immediate aftermath of the Lion Air accident were based on the best information available at the time.”
From the moment that Lion Air Flight 610 nosedived into the Java Sea with 189 people onboard, FAA officials were playing catch-up. The first shock, said people familiar with the details, came when FAA engineers in the Seattle region discovered Boeing hadn’t submitted revised safety assessments detailing the latest changes to MCAS, the automated flight-control system at the heart of the problem.
Agency engineers struggled to understand MCAS’s intricacies. As government and Boeing experts met to discuss responses, Boeing engineers seemed to realize they had underestimated MCAS’s ability to push the plane’s nose down forcefully and repeatedly, and overestimated how pilots would respond, said a person familiar with the FAA’s response.
Days after the Lion Air crash, Rep. Peter DeFazio (D., Ore.), chairman of the House Transportation and Infrastructure Committee, met Ali Bahrami, the FAA’s top safety official, for a closed-door briefing. The FAA contingent sought to persuade the lawmaker, an FAA critic, that the crash exposed operational rather than design problems, Mr. DeFazio said in an interview. “We were assured this was one-off” as an event, he said.
The FAA prepared its standard postcrash risk analysis, called Transport Airplane Risk Assessment Methodology, which calculated the potential extent of the problem.
It received a flood of information about pilot and maintenance missteps, and other data from the scene that suggested there were systemic repair and inspection shortcomings at Lion Air. As neither FAA engineers nor most of their bosses fully grasped the intricacies of MCAS, they felt comfortable delving into issues many of them understood better, including how pilots reacted to emergencies with the system, said some of the people briefed on the deliberations. FAA managers worked with U.S. airlines to scour MAX flight records over the more than two years. They didn’t find any event revealing an MCAS malfunction similar to the one in the Lion Air dive.
Early on, regulators emphasized the results of Boeing’s flight-simulator sessions. Boeing, which conducted tests in an advanced flight simulator near Seattle, told regulators its analysis showed pilots generally starting to respond within several seconds, an acceptable result, despite a cacophony of blaring cockpit alerts and warning lights, said some of the people briefed on the results.
The crews in those simulated emergencies primarily were Boeing pilots far more experienced than typical airline pilots, said the people. In the crush of fast-moving developments, the FAA seemingly didn’t focus on the makeup of the simulator crews, said the people briefed on the results.
With initial information at hand, the FAA focused on an emergency directive. In the dry technical language used for routine maintenance inspections, the FAA reminded pilots to adhere to longstanding procedures when encountering similar emergencies. The directive didn’t fully spell out the harrowing details of an MCAS malfunction, specifically how the system pushed down the plane’s nose over pilot attempts to override it.
The issue of whether to mention MCAS was debated at lower levels of the FAA, making its way to the agency’s acting head, Daniel Elwell, who endorsed the decision not to identify the system, said a person with knowledge of the deliberations. Boeing later spelled out MCAS details in a Nov. 10 bulletin to airlines.
The FAA spokesman said MCAS wasn’t mentioned due to concerns that it could have interfered with Indonesian investigators by implying a probable cause of the accident.
FAA officials embraced Boeing’s reassuring message portraying the aircraft’s design as essentially sound and indicating that a relatively swift fix would alleviate concerns. Boeing and agency leaders continued to reiterate the notion the Lion Air crash was primarily due to pilot errors and maintenance lapses, said current and former industry officials, federal regulators and outside safety experts. After accident investigators issued a preliminary report, Boeing issued a statement pointing to potential pilot and maintenance lapses in the document.
Mr. Lawrence, the agency’s new certification chief, relied on recommendations from lower-level staffers who tended to support many of Boeing’s positions, agency officials and safety experts said. He spent minimal time reviewing the directive, one of them said, before the FAA released it about a week after the Lion Air crash.
Around the same time, more than 20 officials in the FAA’s Seattle-area certification office gathered to hash out responses. They discussed accident assessments, the pilots’ apparent failure to disable MCAS and signs of maintenance lapses. The participants agreed the directive was a good step while officials learned more about the MCAS.
Before the gathering’s conclusion, FAA experts realized the emergency reminder to pilots “isn’t going to be enough” and they needed to prod Boeing to devise a long-term software solution, the person close to the deliberations said. Boeing, which had independently come to the same conclusion, got to work.
At FAA headquarters, Mr. Lawrence and his lieutenants felt comfortable they had alleviated the short-term danger. Agency personnel understood the emergency directive wouldn’t eliminate the risk of another accident, according to an FAA official involved in the deliberations, but they believed that it would reduce the danger enough that the planes could safely keep flying while Boeing came up with a permanent fix.
One European pilot-union leader recalls getting into a shouting match with a Boeing official about the extensive use of test pilots in simulators after the Lion Air crash. During a break in a meeting to update the region’s aviators and MAX operators about the status of the software fix, the union official maintained that test pilots in simulators couldn’t be viewed as reliable stand-ins for airline pilots flying planes. The Boeing technical expert, he said, maintained just as strongly that the industry had followed that course for decades, leading to recent record low accident rates.
‘Don’t call it a fix’
Boeing encouraged FAA personnel to call the planned software fix an “enhancement.” Senior agency officials publicly and privately echoed the same line, and dissected crew errors rather than Boeing’s design shortcomings.
At the FAA’s working levels, though, there was some frustration at Boeing’s stance. At one meeting between FAA officials and Boeing personnel not long after the Lion Air crash, the person familiar with the agency’s response said, officials were surprised at Boeing’s emphasis on language.
“Don’t call it a fix,” this person recalls a Boeing official saying. “These are enhancements.”
“Call it whatever you want,” an FAA official snapped, saying the most pressing issue was shoring up MCAS, not quibbling over how to describe it.
By mid-February, the FAA’s decision to forego a more forceful response appeared to be paying off. Agency officials were weeks from approving a new version of the MAX software, said the FAA official close to the deliberations.
Then Ethiopian Flight 302 plowed into a field near Addis Ababa, killing all 157 on board. The FAA began conducting a fresh risk analysis, seeking to quantify the likelihood of a third such emergency.
Amid signs the MCAS system was central to the second crash, governments around the world ordered fleets grounded. The FAA maintained publicly that the specifics were too unclear to merit such decisive action.
Two days after the crash, FAA engineers and managers in the Seattle area concluded immediate grounding was the only option, said people familiar with the details.
“Why is this airplane still flying?” one FAA engineer asked at a meeting, said a person familiar with the gathering. The recommendation was waiting for Mr. Lawrence when he walked into the office March 13, three days after the crash.
Canadian regulators handed over refined satellite-tracking charts that revealed similarities between the two MAX crashes. On March 13, the FAA pulled the trigger on a grounding order.
The FAA’s decision came after every major aviation country already had deemed the MAX unsafe. “We have said all along that…we are a data-driven organization,” the FAA’s Mr. Elwell told reporters. “The data coalesced today and we made the call.”
END
‘Why Is This Airplane Still Flying?’ The FAA Missteps That Kept Boeing’s MAX Aloft
Although an agency analysis showed a good chance the Lion Air malfunction would recur, the FAA followed Boeing’s lead on key aspects of the response
By Andy Pasztor and Andrew Tangel
Oct. 28, 2019 8:16 pm ET
Just after a Boeing Co. 737 MAX jet crashed in Indonesia a year ago, FAA officials asked themselves: Should they warn the world the entire fleet could have a design flaw?
A Federal Aviation Administration analysis showed a good chance the same malfunction would crop up again, according to agency officials and people briefed on the results. Even under the most optimistic scenario, the agency’s statistical models projected a high likelihood of a similar emergency within roughly a year.
Yet in the end, the FAA didn’t formally consider grounding the MAX or taking other drastic steps, based on the sketchy early information from the October 2018 accident. It simply reminded pilots how to respond to such emergencies.
That decision set the stage for a second fatal MAX crash, of Ethiopian Airlines Flight 302, less than five months later.
In a critical misstep, FAA officials relied extensively on Boeing’s initial flight-simulator test results, some of the people said. Boeing largely used its cadre of highly experienced test pilots, an industry practice the FAA and accident investigators later acknowledged wasn’t appropriate to gauge how the other pilots would react in a real emergency.
On Monday, an FAA spokesman said the reminder to pilots “followed a rigorous and well-defined process,” adding that the agency’s overall response met regulatory requirements, was approved by multiple agency officials and reflected widely accepted industrywide standards.
Earl Lawrence, head of the FAA’s aircraft-certification office, which approves and monitors new airplane models, was fresh in his post and lacked details about the MAX’s original approval to delve deeply into the situation, said people briefed on the deliberations. He and his team followed Boeing’s lead on diagnosing and resolving the crisis, including Boeing’s predictions that a fix could be developed in time to avert another tragedy.
From front-line FAA engineers and midlevel managers to high-ranking officials at agency headquarters, the consensus was that it wasn’t necessary to take drastic action such as grounding the fleet. FAA officials vouched for the safety of the MAX, even though it included the MCAS feature that eventually was implicated in both crashes.
How the FAA decided against a more-aggressive response to the crash hasn’t been reported before in detail.
That stance has prompted a barrage of criticism on Capitol Hill and elsewhere. The FAA’s decisions are expected to feature in Senate and House committee hearings this week. Lawmakers are expected to ask Boeing Chief Executive Dennis Muilenburg about the company’s interactions with the FAA, including whether it urged the regulator to avoid taking more-forceful action between the crashes.
As the MAX edges toward service again, probably early next year, European safety authorities have formally shelved the idea of ungrounding the MAX simultaneously with the FAA. They want to perform their own simulator tests and analyze additional safeguards.
Other foreign regulators, too, are poised to conduct separate evaluations—something once unthinkable among overseas regulators, who typically followed the FAA in vetting the safety of U.S.-certified planes.
Boeing agreed with the FAA that it was appropriate to reiterate existing pilot procedures before rolling out software changes, a company spokesman said. “The safety of everyone flying on our airplanes was paramount as the analysis was done and the mitigating actions were taken,” he said, adding: “Boeing began work on a potential software update shortly after the Lion Air accident, when MCAS was identified as a potential factor. Boeing agreed to the FAA’s timeline for implementing the software update.”
The FAA spokesman said “There was no regulatory requirement in this instance to use average pilots,” adding that current testing procedures require them. He said Mr. Lawrence “is well-versed in certification standards” even though he wasn’t involved early on with the MAX, and “all meetings and conversations in the immediate aftermath of the Lion Air accident were based on the best information available at the time.”
From the moment that Lion Air Flight 610 nosedived into the Java Sea with 189 people onboard, FAA officials were playing catch-up. The first shock, said people familiar with the details, came when FAA engineers in the Seattle region discovered Boeing hadn’t submitted revised safety assessments detailing the latest changes to MCAS, the automated flight-control system at the heart of the problem.
Agency engineers struggled to understand MCAS’s intricacies. As government and Boeing experts met to discuss responses, Boeing engineers seemed to realize they had underestimated MCAS’s ability to push the plane’s nose down forcefully and repeatedly, and overestimated how pilots would respond, said a person familiar with the FAA’s response.
Days after the Lion Air crash, Rep. Peter DeFazio (D., Ore.), chairman of the House Transportation and Infrastructure Committee, met Ali Bahrami, the FAA’s top safety official, for a closed-door briefing. The FAA contingent sought to persuade the lawmaker, an FAA critic, that the crash exposed operational rather than design problems, Mr. DeFazio said in an interview. “We were assured this was one-off” as an event, he said.
The FAA prepared its standard postcrash risk analysis, called Transport Airplane Risk Assessment Methodology, which calculated the potential extent of the problem.
It received a flood of information about pilot and maintenance missteps, and other data from the scene that suggested there were systemic repair and inspection shortcomings at Lion Air. As neither FAA engineers nor most of their bosses fully grasped the intricacies of MCAS, they felt comfortable delving into issues many of them understood better, including how pilots reacted to emergencies with the system, said some of the people briefed on the deliberations. FAA managers worked with U.S. airlines to scour MAX flight records over the more than two years. They didn’t find any event revealing an MCAS malfunction similar to the one in the Lion Air dive.
Early on, regulators emphasized the results of Boeing’s flight-simulator sessions. Boeing, which conducted tests in an advanced flight simulator near Seattle, told regulators its analysis showed pilots generally starting to respond within several seconds, an acceptable result, despite a cacophony of blaring cockpit alerts and warning lights, said some of the people briefed on the results.
The crews in those simulated emergencies primarily were Boeing pilots far more experienced than typical airline pilots, said the people. In the crush of fast-moving developments, the FAA seemingly didn’t focus on the makeup of the simulator crews, said the people briefed on the results.
With initial information at hand, the FAA focused on an emergency directive. In the dry technical language used for routine maintenance inspections, the FAA reminded pilots to adhere to longstanding procedures when encountering similar emergencies. The directive didn’t fully spell out the harrowing details of an MCAS malfunction, specifically how the system pushed down the plane’s nose over pilot attempts to override it.
The issue of whether to mention MCAS was debated at lower levels of the FAA, making its way to the agency’s acting head, Daniel Elwell, who endorsed the decision not to identify the system, said a person with knowledge of the deliberations. Boeing later spelled out MCAS details in a Nov. 10 bulletin to airlines.
The FAA spokesman said MCAS wasn’t mentioned due to concerns that it could have interfered with Indonesian investigators by implying a probable cause of the accident.
FAA officials embraced Boeing’s reassuring message portraying the aircraft’s design as essentially sound and indicating that a relatively swift fix would alleviate concerns. Boeing and agency leaders continued to reiterate the notion the Lion Air crash was primarily due to pilot errors and maintenance lapses, said current and former industry officials, federal regulators and outside safety experts. After accident investigators issued a preliminary report, Boeing issued a statement pointing to potential pilot and maintenance lapses in the document.
Mr. Lawrence, the agency’s new certification chief, relied on recommendations from lower-level staffers who tended to support many of Boeing’s positions, agency officials and safety experts said. He spent minimal time reviewing the directive, one of them said, before the FAA released it about a week after the Lion Air crash.
Around the same time, more than 20 officials in the FAA’s Seattle-area certification office gathered to hash out responses. They discussed accident assessments, the pilots’ apparent failure to disable MCAS and signs of maintenance lapses. The participants agreed the directive was a good step while officials learned more about the MCAS.
Before the gathering’s conclusion, FAA experts realized the emergency reminder to pilots “isn’t going to be enough” and they needed to prod Boeing to devise a long-term software solution, the person close to the deliberations said. Boeing, which had independently come to the same conclusion, got to work.
At FAA headquarters, Mr. Lawrence and his lieutenants felt comfortable they had alleviated the short-term danger. Agency personnel understood the emergency directive wouldn’t eliminate the risk of another accident, according to an FAA official involved in the deliberations, but they believed that it would reduce the danger enough that the planes could safely keep flying while Boeing came up with a permanent fix.
One European pilot-union leader recalls getting into a shouting match with a Boeing official about the extensive use of test pilots in simulators after the Lion Air crash. During a break in a meeting to update the region’s aviators and MAX operators about the status of the software fix, the union official maintained that test pilots in simulators couldn’t be viewed as reliable stand-ins for airline pilots flying planes. The Boeing technical expert, he said, maintained just as strongly that the industry had followed that course for decades, leading to recent record low accident rates.
‘Don’t call it a fix’
Boeing encouraged FAA personnel to call the planned software fix an “enhancement.” Senior agency officials publicly and privately echoed the same line, and dissected crew errors rather than Boeing’s design shortcomings.
At the FAA’s working levels, though, there was some frustration at Boeing’s stance. At one meeting between FAA officials and Boeing personnel not long after the Lion Air crash, the person familiar with the agency’s response said, officials were surprised at Boeing’s emphasis on language.
“Don’t call it a fix,” this person recalls a Boeing official saying. “These are enhancements.”
“Call it whatever you want,” an FAA official snapped, saying the most pressing issue was shoring up MCAS, not quibbling over how to describe it.
By mid-February, the FAA’s decision to forego a more forceful response appeared to be paying off. Agency officials were weeks from approving a new version of the MAX software, said the FAA official close to the deliberations.
Then Ethiopian Flight 302 plowed into a field near Addis Ababa, killing all 157 on board. The FAA began conducting a fresh risk analysis, seeking to quantify the likelihood of a third such emergency.
Amid signs the MCAS system was central to the second crash, governments around the world ordered fleets grounded. The FAA maintained publicly that the specifics were too unclear to merit such decisive action.
Two days after the crash, FAA engineers and managers in the Seattle area concluded immediate grounding was the only option, said people familiar with the details.
“Why is this airplane still flying?” one FAA engineer asked at a meeting, said a person familiar with the gathering. The recommendation was waiting for Mr. Lawrence when he walked into the office March 13, three days after the crash.
Canadian regulators handed over refined satellite-tracking charts that revealed similarities between the two MAX crashes. On March 13, the FAA pulled the trigger on a grounding order.
The FAA’s decision came after every major aviation country already had deemed the MAX unsafe. “We have said all along that…we are a data-driven organization,” the FAA’s Mr. Elwell told reporters. “The data coalesced today and we made the call.”
END
Join Date: Feb 2006
Location: USA
Posts: 487
Likes: 0
Received 0 Likes
on
0 Posts
Satcom Guru - Peter Lemme
Flawed Assumptions Pave a Path to Disaster
Why wasn't an MCAS malfunction treated as HAZARDOUS, which would have mandated a dual-channel, fail-safe design?
Join Date: Sep 2019
Location: leftcoast
Posts: 2
Likes: 0
Received 0 Likes
on
0 Posts
Why ? Answer --- Schedule- Budget- and retraining which for SW meant an $1million discount if needed.
Boeing saved one million per MAX sent to SW, at a net cost of over 10 Billion- its the new math !
Join Date: Dec 2015
Location: Cape Town, ZA
Age: 62
Posts: 424
Likes: 0
Received 0 Likes
on
0 Posts
Speculation: It reads a bit like an expert witness report, ready for trial before a jury.
Can we assume that Regulators worldwide may not permit looking at certifying the 737 MAX RTS until the ET crash final report is also published, along with a suitable fix to the problems?
Just like elections, capitalist dogma has consequences. The FAA, the FDA and the other oversight agencies are all tainted now, and any approval from them now will be subject to verification.
Join Date: Sep 2019
Location: Here
Age: 73
Posts: 238
Likes: 0
Received 0 Likes
on
0 Posts
This is an extremely long article, but weaves together important points from both the JATR report and the Lion Air crash report, along with FAA regulations. It offers some new insights which were not clear in either of those individual reports, and provides coherent details of all of the multiple failures.
Speculation: It reads a bit like an expert witness report, ready for trial before a jury.
Speculation: It reads a bit like an expert witness report, ready for trial before a jury.
The system did what it was built for.